Warning: Permanently added '10.128.1.90' (ED25519) to the list of known hosts.
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
[   66.077481][ T6468] ==================================================================
[   66.085582][ T6468] BUG: KASAN: slab-use-after-free in __pv_queued_spin_lock_slowpath+0x90b/0xdb0
[   66.094631][ T6468] Write of size 1 at addr ffff88805a184a81 by task syz-executor388/6468
[   66.102944][ T6468] 
[   66.105287][ T6468] CPU: 1 UID: 0 PID: 6468 Comm: syz-executor388 Not tainted 6.13.0-rc1-next-20241205-syzkaller #0
[   66.115861][ T6468] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
[   66.125919][ T6468] Call Trace:
[   66.129222][ T6468]  <TASK>
[   66.132157][ T6468]  dump_stack_lvl+0x241/0x360
[   66.136850][ T6468]  ? __pfx_dump_stack_lvl+0x10/0x10
[   66.142051][ T6468]  ? __pfx__printk+0x10/0x10
[   66.146642][ T6468]  ? _printk+0xd5/0x120
[   66.150799][ T6468]  ? __virt_addr_valid+0x183/0x530
[   66.155908][ T6468]  ? __virt_addr_valid+0x183/0x530
[   66.161018][ T6468]  print_report+0x169/0x550
[   66.165603][ T6468]  ? __virt_addr_valid+0x183/0x530
[   66.170707][ T6468]  ? __virt_addr_valid+0x183/0x530
[   66.175811][ T6468]  ? __virt_addr_valid+0x45f/0x530
[   66.180915][ T6468]  ? __phys_addr+0xba/0x170
[   66.185414][ T6468]  ? __pv_queued_spin_lock_slowpath+0x90b/0xdb0
[   66.191652][ T6468]  kasan_report+0x143/0x180
[   66.196159][ T6468]  ? __pv_queued_spin_lock_slowpath+0x90b/0xdb0
[   66.202413][ T6468]  __pv_queued_spin_lock_slowpath+0x90b/0xdb0
[   66.208492][ T6468]  ? __pfx___pv_queued_spin_lock_slowpath+0x10/0x10
[   66.215093][ T6468]  queued_spin_lock_slowpath+0x42/0x50
[   66.220567][ T6468]  do_raw_spin_lock+0x272/0x370
[   66.225423][ T6468]  ? __pfx_do_raw_spin_lock+0x10/0x10
[   66.230801][ T6468]  __pte_offset_map_lock+0x1ba/0x300
[   66.236089][ T6468]  ? __pfx___pte_offset_map_lock+0x10/0x10
[   66.241898][ T6468]  handle_pte_fault+0x2475/0x5ee0
[   66.246921][ T6468]  ? __pfx_handle_pte_fault+0x10/0x10
[   66.252286][ T6468]  ? __lock_acquire+0x1397/0x2100
[   66.257310][ T6468]  ? mt_find+0x2a9/0x920
[   66.261546][ T6468]  ? __pfx_lock_release+0x10/0x10
[   66.266579][ T6468]  handle_mm_fault+0x1106/0x1bb0
[   66.271529][ T6468]  ? mt_find+0x2a9/0x920
[   66.275790][ T6468]  ? __pfx_handle_mm_fault+0x10/0x10
[   66.281085][ T6468]  ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[   66.287410][ T6468]  ? io_sqe_buffer_register+0x1a4f/0x1f70
[   66.293139][ T6468]  ? lock_mm_and_find_vma+0x9c/0x2f0
[   66.298421][ T6468]  exc_page_fault+0x2b9/0x8b0
[   66.303095][ T6468]  asm_exc_page_fault+0x26/0x30
[   66.307940][ T6468] RIP: 0010:iovec_from_user+0xfb/0x240
[   66.313393][ T6468] Code: 2d dd fc 4c 39 e3 0f 82 0d 01 00 00 48 39 eb 0f 87 04 01 00 00 4c 89 74 24 08 0f 01 cb 0f ae e8 49 ff cd 4c 89 fb 4c 89 3c 24 <49> 8b 6c 24 08 4d 8b 34 24 31 ff 48 89 ee e8 02 30 dd fc 48 85 ed
[   66.333008][ T6468] RSP: 0018:ffffc9000491f8b8 EFLAGS: 00050247
[   66.339081][ T6468] RAX: 0000000000000000 RBX: ffffc9000491f9c0 RCX: ffff88803461da00
[   66.347052][ T6468] RDX: 0000000000000000 RSI: 00000000200002d0 RDI: 00000000200002e0
[   66.355019][ T6468] RBP: 00007ffffffff000 R08: ffffffff84c230c4 R09: 1ffff110170e8940
[   66.362984][ T6468] R10: dffffc0000000000 R11: ffffed10170e8941 R12: 00000000200002d0
[   66.370961][ T6468] R13: 0000000000000000 R14: ffffc9000491f9c0 R15: ffffc9000491f9c0
[   66.378954][ T6468]  ? iovec_from_user+0xd4/0x240
[   66.383815][ T6468]  ? iovec_from_user+0xd4/0x240
[   66.388666][ T6468]  io_sqe_buffers_register+0x29b/0x820
[   66.394132][ T6468]  ? __pfx_io_sqe_buffers_register+0x10/0x10
[   66.400116][ T6468]  ? __fget_files+0x395/0x410
[   66.404789][ T6468]  ? __fget_files+0x2a/0x410
[   66.409379][ T6468]  __se_sys_io_uring_register+0xd1f/0x3b60
[   66.415186][ T6468]  ? __pfx_try_to_wake_up+0x10/0x10
[   66.420383][ T6468]  ? __lock_acquire+0x1397/0x2100
[   66.425400][ T6468]  ? __pfx___se_sys_io_uring_register+0x10/0x10
[   66.431644][ T6468]  ? __pfx___might_resched+0x10/0x10
[   66.436922][ T6468]  ? __might_fault+0xaa/0x120
[   66.441625][ T6468]  ? __pfx_lock_release+0x10/0x10
[   66.446640][ T6468]  ? do_futex+0x392/0x560
[   66.450992][ T6468]  ? __might_fault+0xaa/0x120
[   66.455667][ T6468]  ? rcu_is_watching+0x15/0xb0
[   66.460421][ T6468]  ? __rseq_handle_notify_resume+0x34d/0x14e0
[   66.466481][ T6468]  ? lockdep_hardirqs_on_prepare+0x43d/0x780
[   66.472452][ T6468]  ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[   66.478768][ T6468]  ? do_syscall_64+0x100/0x230
[   66.483524][ T6468]  ? do_syscall_64+0xb6/0x230
[   66.488194][ T6468]  do_syscall_64+0xf3/0x230
[   66.492689][ T6468]  ? clear_bhb_loop+0x35/0x90
[   66.497361][ T6468]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   66.503276][ T6468] RIP: 0033:0x7effbfab4459
[   66.507693][ T6468] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
[   66.527293][ T6468] RSP: 002b:00007effbfa6f238 EFLAGS: 00000246 ORIG_RAX: 00000000000001ab
[   66.535703][ T6468] RAX: ffffffffffffffda RBX: 00007effbfb3e328 RCX: 00007effbfab4459
[   66.543671][ T6468] RDX: 00000000200002c0 RSI: 0000000000000000 RDI: 0000000000000004
[   66.551634][ T6468] RBP: 00007effbfb3e320 R08: 00007effbfa6f6c0 R09: 00007effbfa6f6c0
[   66.559609][ T6468] R10: 100000000000011a R11: 0000000000000246 R12: 00007effbfb0b074
[   66.567586][ T6468] R13: 0000000000000000 R14: 00007ffe20efb280 R15: 00007ffe20efb368
[   66.575564][ T6468]  </TASK>
[   66.578577][ T6468] 
[   66.580890][ T6468] Allocated by task 6468:
[   66.585205][ T6468]  kasan_save_track+0x3f/0x80
[   66.589876][ T6468]  __kasan_slab_alloc+0x66/0x80
[   66.594718][ T6468]  kmem_cache_alloc_noprof+0x1d9/0x380
[   66.600170][ T6468]  ptlock_alloc+0x20/0x70
[   66.604497][ T6468]  pte_alloc_one+0xd3/0x510
[   66.608991][ T6468]  __pte_alloc+0x79/0x3c0
[   66.613311][ T6468]  handle_pte_fault+0x4d4b/0x5ee0
[   66.618323][ T6468]  handle_mm_fault+0x1106/0x1bb0
[   66.623252][ T6468]  exc_page_fault+0x459/0x8b0
[   66.627921][ T6468]  asm_exc_page_fault+0x26/0x30
[   66.632762][ T6468] 
[   66.635080][ T6468] Freed by task 6474:
[   66.639045][ T6468]  kasan_save_track+0x3f/0x80
[   66.643711][ T6468]  kasan_save_free_info+0x40/0x50
[   66.648730][ T6468]  __kasan_slab_free+0x59/0x70
[   66.653483][ T6468]  kmem_cache_free+0x195/0x410
[   66.658239][ T6468]  ___pte_free_tlb+0x2b/0x140
[   66.662906][ T6468]  free_pte+0x142/0x190
[   66.667052][ T6468]  unmap_page_range+0x4062/0x48d0
[   66.672069][ T6468]  zap_page_range_single+0x45c/0x630
[   66.677347][ T6468]  do_madvise+0x2774/0x4d90
[   66.681864][ T6468]  __x64_sys_madvise+0xa6/0xc0
[   66.686626][ T6468]  do_syscall_64+0xf3/0x230
[   66.691124][ T6468]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   66.697007][ T6468] 
[   66.699318][ T6468] The buggy address belongs to the object at ffff88805a184a80
[   66.699318][ T6468]  which belongs to the cache page->ptl of size 64
[   66.713103][ T6468] The buggy address is located 1 bytes inside of
[   66.713103][ T6468]  freed 64-byte region [ffff88805a184a80, ffff88805a184ac0)
[   66.726629][ T6468] 
[   66.728974][ T6468] The buggy address belongs to the physical page:
[   66.735384][ T6468] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5a184
[   66.744133][ T6468] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[   66.751322][ T6468] page_type: f5(slab)
[   66.755305][ T6468] raw: 00fff00000000000 ffff88801ac4f780 dead000000000122 0000000000000000
[   66.763878][ T6468] raw: 0000000000000000 00000000802a002a 00000000f5000000 0000000000000000
[   66.772463][ T6468] page dumped because: kasan: bad access detected
[   66.778963][ T6468] page_owner tracks the page as allocated
[   66.784667][ T6468] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5834, tgid 5834 (syz-executor388), ts 65775696518, free_ts 65774968625
[   66.804190][ T6468]  post_alloc_hook+0x1f4/0x240
[   66.808951][ T6468]  get_page_from_freelist+0x365c/0x37a0
[   66.814517][ T6468]  __alloc_frozen_pages_noprof+0x292/0x710
[   66.820311][ T6468]  alloc_pages_mpol+0x30e/0x550
[   66.825151][ T6468]  allocate_slab+0x8f/0x3a0
[   66.829649][ T6468]  ___slab_alloc+0xc27/0x14a0
[   66.834320][ T6468]  __slab_alloc+0x58/0xa0
[   66.838646][ T6468]  kmem_cache_alloc_noprof+0x268/0x380
[   66.844098][ T6468]  ptlock_alloc+0x20/0x70
[   66.848422][ T6468]  pte_alloc_one+0xd3/0x510
[   66.852944][ T6468]  __pte_alloc+0x79/0x3c0
[   66.857265][ T6468]  copy_pmd_range+0x6fb4/0x77a0
[   66.862103][ T6468]  copy_page_range+0x99f/0xe90
[   66.866859][ T6468]  copy_mm+0x12d2/0x2060
[   66.871095][ T6468]  copy_process+0x1845/0x3d80
[   66.875763][ T6468]  kernel_clone+0x226/0x8e0
[   66.880260][ T6468] page last free pid 973 tgid 973 stack trace:
[   66.886398][ T6468]  free_frozen_pages+0xe0d/0x10e0
[   66.891419][ T6468]  vfree+0x186/0x2e0
[   66.895308][ T6468]  delayed_vfree_work+0x56/0x80
[   66.900150][ T6468]  process_scheduled_works+0xa66/0x1840
[   66.905691][ T6468]  worker_thread+0x870/0xd30
[   66.910269][ T6468]  kthread+0x2f0/0x390
[   66.914326][ T6468]  ret_from_fork+0x4b/0x80
[   66.918734][ T6468]  ret_from_fork_asm+0x1a/0x30
[   66.923485][ T6468] 
[   66.925797][ T6468] Memory state around the buggy address:
[   66.931412][ T6468]  ffff88805a184980: 00 00 00 00 fc fc fc fc 00 00 00 00 00 00 00 00
[   66.939488][ T6468]  ffff88805a184a00: fc fc fc fc 00 00 00 00 00 00 00 00 fc fc fc fc
[   66.947542][ T6468] >ffff88805a184a80: fa fb fb fb fb fb fb fb fc fc fc fc 00 00 00 00
[   66.955589][ T6468]                    ^
[   66.959684][ T6468]  ffff88805a184b00: 00 00 00 00 fc fc fc fc 00 00 00 00 00 00 00 00
[   66.967740][ T6468]  ffff88805a184b80: fc fc fc fc 00 00 00 00 00 00 00 00 fc fc fc fc
[   66.975793][ T6468] ==================================================================
[   66.984255][ T6468] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   66.991468][ T6468] CPU: 1 UID: 0 PID: 6468 Comm: syz-executor388 Not tainted 6.13.0-rc1-next-20241205-syzkaller #0
[   67.002051][ T6468] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
[   67.012097][ T6468] Call Trace:
[   67.015373][ T6468]  <TASK>
[   67.018295][ T6468]  dump_stack_lvl+0x241/0x360
[   67.022984][ T6468]  ? __pfx_dump_stack_lvl+0x10/0x10
[   67.028176][ T6468]  ? __pfx__printk+0x10/0x10
[   67.032759][ T6468]  ? lock_release+0xbf/0xa30
[   67.037371][ T6468]  ? vscnprintf+0x5d/0x90
[   67.041693][ T6468]  panic+0x349/0x880
[   67.045584][ T6468]  ? check_panic_on_warn+0x21/0xb0
[   67.050686][ T6468]  ? __pfx_panic+0x10/0x10
[   67.055093][ T6468]  ? mark_lock+0x9a/0x360
[   67.059416][ T6468]  ? _raw_spin_unlock_irqrestore+0xd8/0x140
[   67.065300][ T6468]  ? _raw_spin_unlock_irqrestore+0xdd/0x140
[   67.071186][ T6468]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[   67.077502][ T6468]  ? print_report+0x502/0x550
[   67.082171][ T6468]  check_panic_on_warn+0x86/0xb0
[   67.087101][ T6468]  ? __pv_queued_spin_lock_slowpath+0x90b/0xdb0
[   67.093333][ T6468]  end_report+0x77/0x160
[   67.097572][ T6468]  kasan_report+0x154/0x180
[   67.102067][ T6468]  ? __pv_queued_spin_lock_slowpath+0x90b/0xdb0
[   67.108302][ T6468]  __pv_queued_spin_lock_slowpath+0x90b/0xdb0
[   67.114364][ T6468]  ? __pfx___pv_queued_spin_lock_slowpath+0x10/0x10
[   67.120949][ T6468]  queued_spin_lock_slowpath+0x42/0x50
[   67.126403][ T6468]  do_raw_spin_lock+0x272/0x370
[   67.131253][ T6468]  ? __pfx_do_raw_spin_lock+0x10/0x10
[   67.136626][ T6468]  __pte_offset_map_lock+0x1ba/0x300
[   67.141908][ T6468]  ? __pfx___pte_offset_map_lock+0x10/0x10
[   67.147710][ T6468]  handle_pte_fault+0x2475/0x5ee0
[   67.152744][ T6468]  ? __pfx_handle_pte_fault+0x10/0x10
[   67.158121][ T6468]  ? __lock_acquire+0x1397/0x2100
[   67.163149][ T6468]  ? mt_find+0x2a9/0x920
[   67.167402][ T6468]  ? __pfx_lock_release+0x10/0x10
[   67.172432][ T6468]  handle_mm_fault+0x1106/0x1bb0
[   67.177373][ T6468]  ? mt_find+0x2a9/0x920
[   67.181638][ T6468]  ? __pfx_handle_mm_fault+0x10/0x10
[   67.186936][ T6468]  ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[   67.193264][ T6468]  ? io_sqe_buffer_register+0x1a4f/0x1f70
[   67.199036][ T6468]  ? lock_mm_and_find_vma+0x9c/0x2f0
[   67.204328][ T6468]  exc_page_fault+0x2b9/0x8b0
[   67.209010][ T6468]  asm_exc_page_fault+0x26/0x30
[   67.213883][ T6468] RIP: 0010:iovec_from_user+0xfb/0x240
[   67.219339][ T6468] Code: 2d dd fc 4c 39 e3 0f 82 0d 01 00 00 48 39 eb 0f 87 04 01 00 00 4c 89 74 24 08 0f 01 cb 0f ae e8 49 ff cd 4c 89 fb 4c 89 3c 24 <49> 8b 6c 24 08 4d 8b 34 24 31 ff 48 89 ee e8 02 30 dd fc 48 85 ed
[   67.238958][ T6468] RSP: 0018:ffffc9000491f8b8 EFLAGS: 00050247
[   67.245031][ T6468] RAX: 0000000000000000 RBX: ffffc9000491f9c0 RCX: ffff88803461da00
[   67.252997][ T6468] RDX: 0000000000000000 RSI: 00000000200002d0 RDI: 00000000200002e0
[   67.260971][ T6468] RBP: 00007ffffffff000 R08: ffffffff84c230c4 R09: 1ffff110170e8940
[   67.268934][ T6468] R10: dffffc0000000000 R11: ffffed10170e8941 R12: 00000000200002d0
[   67.276897][ T6468] R13: 0000000000000000 R14: ffffc9000491f9c0 R15: ffffc9000491f9c0
[   67.284874][ T6468]  ? iovec_from_user+0xd4/0x240
[   67.289728][ T6468]  ? iovec_from_user+0xd4/0x240
[   67.294571][ T6468]  io_sqe_buffers_register+0x29b/0x820
[   67.300029][ T6468]  ? __pfx_io_sqe_buffers_register+0x10/0x10
[   67.306007][ T6468]  ? __fget_files+0x395/0x410
[   67.310677][ T6468]  ? __fget_files+0x2a/0x410
[   67.315266][ T6468]  __se_sys_io_uring_register+0xd1f/0x3b60
[   67.321070][ T6468]  ? __pfx_try_to_wake_up+0x10/0x10
[   67.326265][ T6468]  ? __lock_acquire+0x1397/0x2100
[   67.331288][ T6468]  ? __pfx___se_sys_io_uring_register+0x10/0x10
[   67.337570][ T6468]  ? __pfx___might_resched+0x10/0x10
[   67.342853][ T6468]  ? __might_fault+0xaa/0x120
[   67.347532][ T6468]  ? __pfx_lock_release+0x10/0x10
[   67.352552][ T6468]  ? do_futex+0x392/0x560
[   67.356963][ T6468]  ? __might_fault+0xaa/0x120
[   67.361633][ T6468]  ? rcu_is_watching+0x15/0xb0
[   67.366393][ T6468]  ? __rseq_handle_notify_resume+0x34d/0x14e0
[   67.372458][ T6468]  ? lockdep_hardirqs_on_prepare+0x43d/0x780
[   67.378458][ T6468]  ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[   67.384778][ T6468]  ? do_syscall_64+0x100/0x230
[   67.389540][ T6468]  ? do_syscall_64+0xb6/0x230
[   67.394207][ T6468]  do_syscall_64+0xf3/0x230
[   67.398706][ T6468]  ? clear_bhb_loop+0x35/0x90
[   67.403378][ T6468]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   67.409263][ T6468] RIP: 0033:0x7effbfab4459
[   67.413673][ T6468] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
[   67.433271][ T6468] RSP: 002b:00007effbfa6f238 EFLAGS: 00000246 ORIG_RAX: 00000000000001ab
[   67.441681][ T6468] RAX: ffffffffffffffda RBX: 00007effbfb3e328 RCX: 00007effbfab4459
[   67.449644][ T6468] RDX: 00000000200002c0 RSI: 0000000000000000 RDI: 0000000000000004
[   67.457604][ T6468] RBP: 00007effbfb3e320 R08: 00007effbfa6f6c0 R09: 00007effbfa6f6c0
[   67.465573][ T6468] R10: 100000000000011a R11: 0000000000000246 R12: 00007effbfb0b074
[   67.473535][ T6468] R13: 0000000000000000 R14: 00007ffe20efb280 R15: 00007ffe20efb368
[   67.481504][ T6468]  </TASK>
[   67.484766][ T6468] Kernel Offset: disabled
[   67.489088][ T6468] Rebooting in 86400 seconds..